raccoon | e02eee1586a84d7d556d451ae08a9a0fb39d14e5f9dcc51102439e030fec3a70

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 15:35

Target

a9837fcd20a99e33f3db89b4850bd6db.exe
Size

461KB
MD5

a9837fcd20a99e33f3db89b4850bd6db
SHA1

dff46eaf344a1478851a251b230fb5b67c5b16e5
SHA256

e02eee1586a84d7d556d451ae08a9a0fb39d14e5f9dcc51102439e030fec3a70
SHA512

7a33a7333538e480d0143b210362f66a0f24e1d3167ec7fe9838167e36e36e013b0c57d46810fb7fbd4da336e13f3d75d0c25b67c32c30555cf630b69fa0cc95
SSDEEP

12288:+kRfNNwgrhhYBtcZtZ9LZlQ/PcZ78lOmi:PfNGOhYmbQs6i

Score

10^/10

raccoon stealer

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 4 IoCs

resource	yara_rule
behavioral2/memory/4972-2-0x0000000002FB0000-0x000000000303F000-memory.dmp	family_raccoon_v1
behavioral2/memory/4972-3-0x0000000000400000-0x0000000002D01000-memory.dmp	family_raccoon_v1
behavioral2/memory/4972-4-0x0000000000400000-0x0000000002D01000-memory.dmp	family_raccoon_v1
behavioral2/memory/4972-7-0x0000000002FB0000-0x000000000303F000-memory.dmp	family_raccoon_v1

Program crash 6 IoCs

pid	pid_target	Process	procid_target
3256	4972	WerFault.exe	67
4552	4972	WerFault.exe	67
2244	4972	WerFault.exe	67
4704	4972	WerFault.exe	67
2932	4972	WerFault.exe	67
4888	4972	WerFault.exe	67

C:\Users\Admin\AppData\Local\Temp\a9837fcd20a99e33f3db89b4850bd6db.exe
"C:\Users\Admin\AppData\Local\Temp\a9837fcd20a99e33f3db89b4850bd6db.exe"
1⤵
PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 740
  2⤵
  - Program crash
  PID:3256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 776
  2⤵
  - Program crash
  PID:4552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 756
  2⤵
  - Program crash
  PID:2244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 884
  2⤵
  - Program crash
  PID:4704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 1196
  2⤵
  - Program crash
  PID:2932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 1216
  2⤵
  - Program crash
  PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4972 -ip 4972
1⤵
PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4972 -ip 4972
1⤵
PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4972 -ip 4972
1⤵
PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4972 -ip 4972
1⤵
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4972 -ip 4972
1⤵
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4972 -ip 4972
1⤵
PID:3104

memory/4972-1-0x0000000003050000-0x0000000003150000-memory.dmp

Filesize
1024KB

Download
memory/4972-2-0x0000000002FB0000-0x000000000303F000-memory.dmp

Filesize
572KB

Download
memory/4972-3-0x0000000000400000-0x0000000002D01000-memory.dmp

Filesize
41.0MB

Download
memory/4972-4-0x0000000000400000-0x0000000002D01000-memory.dmp

Filesize
41.0MB

Download
memory/4972-5-0x0000000003050000-0x0000000003150000-memory.dmp

Filesize
1024KB

Download
memory/4972-7-0x0000000002FB0000-0x000000000303F000-memory.dmp

Filesize
572KB

Download